If a blog is created, and the "Make this blog public" checkbox is cleared, then the blog doesn't appear in the Blog List.  In theory, this should prevent unauthorized users from accessing the blog through any means.

However, I noticed that during certain operations, the BlogID is passed in the URL (e.g. ".../tabid/100/BlogID/2/Default.aspx").  I discovered that a curious surfer, even one that isn't logged in at all, can edit this BlogID and see some basic information about the Blog (summary line, creation date, and most importantly, the author's username or full name).  They can't see the articles, but even so, this potentially exposes information that may not be intended to be public.  This is even true if the [Module Settings]/[Personal Blog Page] is set to a parent blog (so that the blog list shows only the child blogs).

While I understand that is probably low-risk for most deployments, please address this as a security issue.

- EJSawyer